Case: 13-1816 Document: 003111316712 Page: 1 Date Filed: 07/08/2013 No. 13-1816 In the United States Court of Appeals for the Third Circuit United States of America, Plaintiff-Appellee, v. Andrew Auernheimer, Defendant-Appellant. Appeals from the United States District Court for the District of New Jersey, Case No. 11-CR-470, Judge Susan D. Wigenton Brief of Meredith Patterson, Brendan O’Connor, Sergey Bratus, Gabriella Coleman, Peyton Engel, Matthew Green, Dan Hirsch, Dan Kaminsky, Samuel Liles, Shane MacDougall, Brian Martin, C. Thomas, and Peiter Zatko as Amici Curiae Supporting Appellant Alex Muentz Adjunct Instructor Department of Criminal Justice Gladfelter Hall, 5th floor Temple University 1115 Polett Walk Philadelphia PA 19122 (215) 806-4383 Case: 13-1816 Document: 003111316712 Page: 2 Date Filed: 07/08/2013 Table of Contents Interest of Amici Curiae .......................1 Non-Party Statement .........................2 Consent to File ............................2 Summary of Argument.........................2 Argument................................3 1 Allowing a corporation to serve data publicly, then state after the fact that access was secretly restricted and thus impose criminal liability, amounts to a private criminal law, and may also violate the Ex Post Facto Clause. ...............................3 2 Criminalizing access to publicly-offered material is not in the public in- terest, because it prevents the security research community from exer- cising its consumer-protecting role. .................. 16 Conclusion............................... 21 Certificate of Bar Membership.................... 23 Certificate of Compliance With Word Count Requirements ... 23 Certificate of Service ........................ 23 Certificate of Identical Compliance of Briefs ........... 24 Certificate of Virus Check ...................... 24 ii Case: 13-1816 Document: 003111316712 Page: 3 Date Filed: 07/08/2013 Table of Authorities Cases Calder v. Bull, 3 Dall. 386, 1 L.Ed. 648 (1798) . 14 Grimshaw v. Ford Motor Co., 191 CA3d 757, 236 Cal. Rptr. 509 (Cal. Ct. App. 1981) . 17, 18 In re Harvard Pilgrim Health Care, Inc., 434 Mass. 51, 746 N.E.2d 513 (Mass. 2001) . .17 International Healthcare Management v. Hawaii Coalition For Health, 332 F.3d 600 (9th Cir. 2003) . 17 Kaiser Aluminum & Chemical Corp. v. U. S. Consumer Product Safety Commission, 574 F.2d 178 (3d Cir. 1978) . .17 Lambert v. People of the State of California, 355 U.S. 225, 78 S.Ct. 240 (1957) . .12 National Ass’n Of State Utility Consumer Advocates v. F.C.C., 457 F.3d 1238 (11th Cir. 2006) . 17 Peugh v. U.S., 569 U.S. ___, 133 S.Ct. 2072 (2013) . 15, 16 Porter v. South Carolina Public Service Com’n, 333 S.C. 12, 507 S.E.2d 328 (S.C. 1998) . 17 U.S. v. Nosal, 676 F.3d 854 (9th Cir. 2012) . 13 Utah State Coalition of Sr. Citizens v. Utah Power and Light Co., 776 P.2d 632 (Utah 1989) . 17 Statutes 10 U.S.C. §1030 . 2, 3, 13 15 U.S.C. §2051 . 17 28 U.S.C. Fed. R. App. P. 29 . 23 28 U.S.C. Fed. R. App. P. 32 . 23 iii Case: 13-1816 Document: 003111316712 Page: 4 Date Filed: 07/08/2013 Interest of Amici Curiae The amici, Meredith Patterson, Brendan O’Connor, Professor Sergey Bratus, Professor Gabriella Coleman, Peyton Engel, Professor Matthew Green, Dan Hirsch, Dan Kaminsky, Professor Samuel Liles, Shane Mac- Dougall, Brian Martin, C. “Space Rogue” Thomas, and Peiter “Mudge” Zatko, are professional security researchers, working in government, aca- demia, and private industry; as a part of their profession, they find se- curity problems affecting the personal information of millions of people and work with the affected parties to minimize harm and learn from the mistakes that created the problem. Members of the amici have testified before Congress, been qualified as experts in federal court, and instructed the military on computer security; they have been given awards for their service to the Department of Defense, assisted the Department of Home- land Security, and spoken at hundreds of conferences. Their résumés, rep- resenting more than two centuries of combined experience, are attached as an Appendix for the information of the Court. They are concerned that the rule established by the lower court, if not corrected, will prevent all legitimate security researchers from doing their jobs; namely, protecting the populace from harm. Accordingly, they wish to aid this Court in un- derstanding the implications of this case in the larger context of modern technology and research techniques. 1 Case: 13-1816 Document: 003111316712 Page: 5 Date Filed: 07/08/2013 Non-Party Statement This brief has been written without the authorship or contribution of any party to the case; the work has been done on a pro bono basis, without financial support for its creation coming from any individual. Consent to File Both parties to this litigation have consented to the filing of this brief. Summary of Argument The Computer Fraud and Abuse Act, 10 U.S.C. §1030, as construed by the United States in this case, allows a private corporation to make, and the government to enforce, a secret, after-the-fact declaration that ac- cess to information made public through standard technological processes was “unauthorized;” this determination, when used to trigger criminal li- ability, is a private law, which violates the United States Constitution. Though this determination was a non-governmental action, it may also constitute a violation of the Ex Post Facto Clause through its binding le- gal effect, as adopted by the United States. Allowing unknowable laws to be written on an ad-hoc basis by private corporations is not only uncon- stitutional, but also harms the public at large by preventing consumer- protecting functions in the digital world. The Court should overturn the judgment of conviction in this case. 2 Case: 13-1816 Document: 003111316712 Page: 6 Date Filed: 07/08/2013 Argument 1. Allowing a corporation to serve data publicly, then state after the fact that access was secretly restricted and thus impose crim- inal liability, amounts to a private criminal law, and may also vi- olate the Ex Post Facto Clause. Mr. Auernheimer’s conviction on charges of violating the Computer Fraud and Abuse Act, 10 U.S.C. §1030, implies that his actions are in some material way different than those of any web user, and that beyond this, his actions violated a clearly-delineated line of authorization as re- quired by §1030(a)(2)(C). Neither of these statements is true. The data Mr. Auernheimer helped to access was intentionally made available by AT&T to the entire Internet, and access occurred through standard pro- tocols that are used by every Web user. Since any determination that the data was somehow nonpublic was made by a private corporation in se- cret, with no external signal or possibility of notice whatsoever, such a determination amounts to a private law of which no reasonable Internet user could have notice. On this basis alone, Mr. Auernheimer’s conviction must be overturned. In addition, since AT&T’s after-the-fact determina- tion created a binding legal effect upon Mr. Auernheimer, it may violate the Ex Post Facto Clause of the United States Constitution, which would provide a separate legal basis upon which Mr. Auernheimer’s conviction must be overturned. 3 Case: 13-1816 Document: 003111316712 Page: 7 Date Filed: 07/08/2013 1.1 How a World Wide Web server works The HyperText Transfer Protocol, or HTTP, is the language that both web clients, such as web browsers, and web servers, which host all content on the World Wide Web, speak. Internet protocols are defined by a stan- dards body called the Internet Engineering Task Force (IETF), through documents called Requests For Comments, or RFCs; HTTP, as it is used today, was defined in RFC 2616.1 This document, promulgated by the Internet Engineering Task Force in 1999,2 specifies the required behav- ior of web servers and web clients of all types on the Internet. Much as speaking a common human language allows two individuals to communi- cate by speech, HTTP allows two computers, whether they be desktops, laptops, servers, tablets, phones, or other devices, to be part of the World Wide Web—and it applies whether a human is using a web browser, or two computers with no user input devices are exchanging web data. HTTP is so popular—it is used by more than a billion people, and several billion devices, each day—because it is so simple. Web servers host all content on the web, whether that content is designated to be public or private. To use a standard analogy, a web server may be thought of as a librarian; rather than a user looking in the library stacks themselves, 1Network Working Group, RFC 2616 - Hypertext Transfer Protocol – HTTP/1.1, Internet Engineering Task Force (June 1999), http://tools. ietf.org/html/rfc2616. 2Previous versions of HTTP have been standardized before 1999 by the IETF, but RFC 2616 is the most recent version of HTTP. 4 Case: 13-1816 Document: 003111316712 Page: 8 Date Filed: 07/08/2013 they ask the librarian. If the document in question is public, the librarian gives it to the user without hesitation; if the document is private, the librarian asks the user for some proof of identity, such as a username and password. If the provided username and password are on the librarian’s roster for that document, the document is given to the user; if not, the librarian refuses to give the document to the user. For a public document, a human might interact with the librarian as in Figure 1. Note the brief conversation: the human requests the docu- ment, and the librarian provides it immediately and without any check for credentials.